Threat
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Publication date not yet evaluated · Added · 3 reports thehackernews.com
Page published · Page updated
Coverage timeline
Why it matters
RatHat marks an in-the-wild shift from static, easily-disrupted scripted mobile malware to adaptive AI-guided automation that is harder for security software to detect and can prioritize higher-value victims.
RatHat is a newly discovered Android banking malware, linked by Zimperium zLabs to China-based actors, that weaponizes a generative AI assistant (reported as Gemini) to autonomously navigate compromised devices. The malware serializes the live Android Accessibility tree into XML and sends it to the AI, which returns element coordinates and navigation instructions (e.g. SCROLL_DOWN), enabling adaptive remote control; it also abuses ADB self-pairing, deploys credential-stealing overlays, intercepts OTPs, and maintains self-restoring persistence.
Summary
RatHat is a newly discovered Android banking/credential-theft malware analyzed by Zimperium zLabs that pairs traditional Accessibility abuse with an AI-driven UI-automation engine used to remotely navigate and control infected devices. Researchers attribute it to threat actors appearing to operate in China, based in part on LLM prompts written in Chinese.[0]
The malware is distributed outside Google Play via malvertising, smishing, and deceptive third-party download portals; after installation it abuses Accessibility permissions to perform autonomous local ADB self-pairing, obtaining a shell-level context it uses to stage native daemons for command execution, covert FRP tunneling, overlay-based credential and OTP theft, lock-screen PIN/pattern capture, and resilient self-restoring persistence.[0]
Cleafy Labs separately documented the command-and-control panel behind RatHat, tracing its evolution 'from BlackCat to Panda Workshop' and situating it within a Malware-as-a-Service and Automated Transfer System (ATS) operation, while aggregated reporting identifies the AI assistant driving RatHat's console as Google Gemini, used to help operators identify higher-value victims.[29][1]
Attack chain
- Distribution: RatHat is spread through malvertising, smishing/SMS, and deceptive phishing sites that lure victims into manually downloading malicious APKs impersonating legitimate apps from outside Google Play.[0]
- Privilege escalation via Accessibility and ADB self-pairing: The malware abuses Accessibility permissions to enable Developer Options and Wireless Debugging, performing autonomous local ADB self-pairing to gain a shell-level execution context without an external computer.[0]
- Agent deployment and persistence: ADB access installs a Go-based agent (liblocal-service.so) that runs shell-privileged commands, bypasses battery restrictions, and manages mutual-restore persistence with a background service that reinstalls the malware if removed.[0]
- Covert tunneling: A second agent (libmedia_codec.so) acts as an FRP reverse-proxy client, establishing a persistent covert tunnel to the attacker for continuous remote control.[0]
- Credential and data theft: RatHat shows fake HTML overlays for banking and cryptocurrency apps, intercepts SMS/notifications/OTPs, records text-change events, extracts browser URLs, and captures lock-screen PINs, passwords, and unlock patterns.[0]
- AI-guided device control: RatHat serializes the live Accessibility tree into XML and queries an AI assistant (reported to be Google Gemini) to locate element coordinates, resolve on-screen text, return navigation commands, and help identify higher-value victims, enabling adaptive remote navigation without real-time operator interaction.[0][1]
- Anti-removal and anti-analysis: RatHat intercepts the uninstall confirmation screen, cancels it, and shows a fake Google Play error overlay; it also employs APK container tampering, a bloated 61MB manifest, and invalid DEX pseudo instructions to hinder analysis.[0]
Disclosure timeline
| Date | Event |
|---|---|
| September 17, 2026 | BleepingComputer reports Zimperium zLabs' discovery and analysis of the RatHat Android malware.[0] |
| September 28, 2026 | Cleafy Labs publishes analysis of the C2 panel behind RatHat, describing its evolution 'from BlackCat to Panda Workshop.'[29] |
Actor profile
RatHat operators (Panda Workshop C2 panel)
The operators behind RatHat appear to operate from China (inferred in part from Chinese-language LLM prompts) and run an evolving command-and-control panel that Cleafy tracked 'from BlackCat to Panda Workshop,' consistent with a Malware-as-a-Service / ATS operation. Attribution is preliminary and based on tooling and language artifacts rather than a formally named threat group.[0][29]
How it works
RatHat does not exploit a software vulnerability; it abuses legitimate Android features. After tricking users into granting Accessibility permissions, it programmatically enables Developer Options and Wireless Debugging and performs autonomous local ADB self-pairing to obtain an on-device shell context, then uses that context to stage native agents (liblocal-service.so and libmedia_codec.so) for command execution, FRP reverse-proxy tunneling, and mutual-restore persistence.[0]
Its distinguishing mechanic is AI-driven UI automation: the malware serializes the live Accessibility tree to XML and queries an AI assistant (reported to be Google Gemini) to locate element center coordinates, resolve on-screen text, and return navigation actions, making automation more adaptable than fixed scripts and harder to detect while helping operators triage higher-value victims.[0][1]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | liblocal-service.so | Go-based agent installed via ADB that runs shell-privileged commands, bypasses battery restrictions, and provides mutual-restore persistence.[0] |
| file-path | libmedia_codec.so | Second agent acting as an FRP reverse-proxy client establishing a persistent covert tunnel to the attacker.[0] |
Key takeaways
- RatHat demonstrates malware operators integrating an external AI assistant (reported to be Google Gemini) into on-device UI automation, enabling adaptive remote navigation and higher-value victim triage while complicating detection.[0][1]
- By performing autonomous local ADB self-pairing via Developer Options and Wireless Debugging, RatHat achieves computer-independent, resilient control and self-restoring persistence, a pattern also seen in the ToxicPanda and RedHook Android families.[0]
- Cleafy's tracking of the RatHat C2 panel 'from BlackCat to Panda Workshop' indicates the threat is backed by an evolving Malware-as-a-Service infrastructure rather than a one-off sample.[29]
Defensive actions
- Do not install APK files from outside Google Play unless the publisher is explicitly trusted.: RatHat is distributed via malvertising, smishing, and phishing sites promoting off-store APK downloads that impersonate legitimate apps.[0]
- Avoid granting Accessibility permissions to apps.: RatHat relies on Accessibility permissions to perform privileged actions, enable Wireless Debugging/ADB self-pairing, and drive on-device automation.[0]
- Regularly scan devices with Google Play Protect.: Play Protect scanning is recommended to detect malware like RatHat on Android devices.[0]
Changelog
- New Cleafy Labs analysis documents the command-and-control panel behind RatHat and its evolution 'from BlackCat to Panda Workshop,' framing RatHat within a Malware-as-a-Service / ATS operation — a dimension absent from the prior dossier.[29]
- The previously 'unnamed AI assistant' driving RatHat's console is now reported to be Google Gemini, used to help operators identify higher-value victims.[1]